Even then, almost all online services are susceptible to re-imagining such that user/session identifiers are self-declared and can be rotated/discarded at any t

Even then, almost all online services are susceptible to re-imagining such that user/session identifiers are self-declared and can be rotated/discarded at any time. To this, some folks would be yelling, "that's not how my/XYZ service works", which is a proxy statement for those unwilling to say, "my/XYZ business model is abusive". And that of course is also why this only happens via regulation.